NIST AI RMF crosswalk

NIST AI Risk Management Framework (AI RMF 1.0)

In short: The NIST AI Risk Management Framework is voluntary and organises AI risk work into four functions: Govern, Map, Measure and Manage. We map seven register controls at function level only. The page we opened names the functions but not the subcategories needed for finer mapping.

What does NIST AI RMF cover?

Voluntary framework. Mappings below are at function level only.

Which register controls map to NIST AI RMF?

Control	Reference	What the text says
GOV-02 Named accountable owner	Govern function	Accountability for AI risk sits with named roles.
GOV-24 Board reporting	Govern function	Oversight of AI risk by leadership.
GOV-01 Agent inventory	Map function	Establishing the context and the systems in use.
GOV-03 Documented purpose	Map function	Recording the intended purpose of each system.
GOV-09 Policy testing before go-live	Measure function	Testing and evaluating behaviour before and during use.
GOV-11 Revocation and kill switch	Manage function	Acting on identified risks, including stopping a system.
GOV-19 Agent incident response	Manage function	Responding to and recovering from incidents.

What did we leave out, and why?

We did not map to AI RMF subcategories such as GOVERN 1.1, because we did not open the full framework text.

If you can point to the official text that supports a mapping, write to the desk.

Reviewed 2026-11-03 by The Register desk